CVE-2026-35482

HIGH 8.0

alf.io has an Authenticated RCE via Extension Script Sandbox Escape

CVSS Score

8.0

EPSS Score

0.0%

EPSS Percentile

11th

alf.io is an open source ticket reservation system for conferences, trade shows, workshops, and meetups. Prior to version 2.0-M5-2606, a sandbox escape vulnerability in the alf.io extension script engine allows an authenticated administrator to execute arbitrary operating system commands on the server. The extension system is intended to execute restricted JavaScript in a sandboxed Rhino environment; however, a combination of an unguarded injected Java object (`returnClass`) and an incomplete AST blocklist allows the sandbox to be fully escaped using Java reflection without triggering any validation errors. Version 2.0-M5-2606 patches the issue.

CWE	CWE-863
Vendor	alfio-event
Product	alf.io
Published	Jun 2, 2026
Last Updated	Jun 3, 2026

Stay Ahead of the Next One

Get instant alerts for alfio-event alf.io

Be the first to know when new high vulnerabilities affecting alfio-event alf.io are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Affected Versions

alfio-event / alf.io

< 2.0-M5-2606

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/alfio-event/alf.io/security/advisories/GHSA-3w8f-mcf6-cm7h